Further krb5_string_to_keysalts() refactoring

Make a separate string_to_keysalt() parser, which for now is private
and destructive.